CVE-2026-32690

Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by the user the secrets stored as nested fields were not masked. If you do not store variables with sensitive values in JSON form, you are not affected. Otherwise please upgrade to Apache Airflow 3.2.0 that has the fix implemented

CVSS v3 3.7 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/apache/airflow/pull/63480	Issue Tracking
https://lists.apache.org/thread/7rnzxofntcznqxnhsmjvvlvygwph7rn5	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/04/17/6	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Los secretos en Variables guardadas como diccionarios JSON no fueron correctamente redactados - en caso de que estas variables fueran recuperadas por el usuario, los secretos almacenados como campos anidados no fueron enmascarados. Si no almacena variables con valores sensibles en formato JSON, no está afectado. De lo contrario, por favor, actualice a Apache Airflow 3.2.0 que tiene la corrección implementada.

Information

Published : 2026-04-18 07:16

Updated : 2026-10-26 22:10

NVD link : CVE-2026-32690

Mitre link : CVE-2026-32690

CVE.ORG link : CVE-2026-32690

JSON object : View

Products Affected

apache

airflow

CWE

CWE-668

Exposure of Resource to Wrong Sphere

{"id": "CVE-2026-32690", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32690", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-20T16:11:00.447056Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Airflow", "versions": [{"status": "affected", "version": "3.0.0", "lessThan": "3.2.0", "versionType": "semver"}], "packageName": "apache-airflow", "collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected"}]}], "published": "2026-04-18T07:16:10.683", "references": [{"url": "https://github.com/apache/airflow/pull/63480", "tags": ["Issue Tracking"], "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/7rnzxofntcznqxnhsmjvvlvygwph7rn5", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/04/17/6", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-668"}]}], "descriptions": [{"lang": "en", "value": "Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by the user the secrets stored as nested fields were not masked.\n\nIf you do not store variables with sensitive values in JSON form, you are not affected. Otherwise please upgrade to Apache Airflow 3.2.0 that has the fix implemented"}, {"lang": "es", "value": "Los secretos en Variables guardadas como diccionarios JSON no fueron correctamente redactados - en caso de que estas variables fueran recuperadas por el usuario, los secretos almacenados como campos anidados no fueron enmascarados.\n\nSi no almacena variables con valores sensibles en formato JSON, no est\u00e1 afectado. De lo contrario, por favor, actualice a Apache Airflow 3.2.0 que tiene la correcci\u00f3n implementada."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D8133DE3-F556-42F5-8298-FD4CF40787B6", "versionEndExcluding": "3.2.0", "versionStartIncluding": "3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}